Question

A financial services company migrates several workloads to a public cloud provider using an Infrastructure as a Service (IaaS) model. During a security review, the CISO asks who is responsible for applying operating system security patches to the virtual machines running the company's applications. Under the standard cloud shared responsibility model for IaaS, who bears this responsibility?

Accepted Answer

The cloud customer, because guest OS patching falls within the customer's scope under IaaS

Answer

The cloud service provider, because it owns and maintains all underlying compute hardware

Answer

The cloud service provider, because patching is always a provider duty regardless of service model

Answer

A third-party auditor, because compliance certification bodies manage OS-level maintenance